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Abstract — We study a fingerprinting game in which the collu- 
sion channel is unknown. The encoder embeds fingerprints into 
a host sequence and provides the decoder with the capability to 
trace back pirated copies to the colluders. 

Fingerprinting capacity has recently been derived as the limit 
value of a sequence of maxmin games with mutual information as 
the payoff function. However, these games generally do not admit 
saddle-point solutions and are very hard to solve numerically. 
Here under the so-called Boneh-Shaw marking assumption, we 
reformulate the capacity as the value of a single two-person zero- 
sum game, and show that it is achieved by a saddle-point solution. 

H the maximal coalition size is k and the fingerprint alphabet 
is binary, we derive equations that can numerically solve the 
capacity game for arbitrary k. We also provide tight upper and 
lower bounds on the capacity. Finally, we discuss the asymptotic 
behavior of the fingerprinting game for large k and practical 
implementation issues. 

I. Introduction 

Fingerprinting is a technique for copyright protection. It was 
first proposed by Wagner in 1983 [1] and has drawn a lot 
of attention in recent years. The content distributor embeds 
a unique mark, or fingerprint, within each licensed copy. By 
forming a group of users (pirates), the coalition can detect 
the fingerprints by inspecting the marks in each copy, and 
create a forgery that has only weak traces of their copies. A 
collusion-resistant fingerprinting system is designed to combat 
the collusive attacks. 

Boneh and Shaw in [2] proposed the marking assumption 
for the fingerprinting problem. In this setup, fingerprints are 
a string of marks allocated throughout the host content. The 
locations of the marks are assumed unknown to the pirates. By 
comparing their available copies, the coalition can remove or 
replace the detected marks, but cannot modify those marks at 
which their copies agree. As a result, we can ignore the host 
sequence and consider only the fingerprints in our analysis. 

Tardos in 2003 [3] invented a simple but efficient ran- 
domized fingerprinting code that invites many subsequent 
works, such as [4], [5]. Amiri and Tardos recently [6] (and 
independently of our work) further improved the rate by 
constructing a code based on a two-person zero-sum game. 
Although the code is far more efficient than the previous 
scheme, the intense computational complexity makes it less 
appealing for practical use. 

A few researchers have also studied the problem from the 
information-theoretic point of view [6], [7], [8], [9], [10]. 



Here we focus on finding the maximum achievable rate, or 
capacity, of the fingerprinting system. Recently, Moulin in [9] 
provided the capacity formula in a general setup. We study 
specifically the marking assumption in this paper and show 
that the capacity is indeed the rate achieved in [6]. 

One concern is that neither the encoder nor the decoder 
knows the actual coalition size in real applications [11]. We 
show that this is actually not a big issue. The saddle-point 
property states that for a fingerprinting code designed for a 
maximal coalition size k, there exists a unique saddle-point 
solution that achieves the capacity. That is, neither the content 
distributor nor the coalition can gain by deviating from its 
optimal strategy. As a result, the system is secure for any 
collusive attack of size no more than k. Furthermore, even if 
the size-fc anticipation is violated, no innocent user is accused 
[9]. The pirates are simply too powerful and we have not 
enough evidence to accuse them. Instead, the decoder gives 
us the more probable suspects which may allow the legal 
authority to do further investigation. 

In this paper, we reformulate the capacity formula in [9] as 
the value of a single two-person zero-sum game and show that 
it admits a saddle-point solution. In the binary alphabet case, 
new capacity bounds are provided. The proofs not only show 
that the binary fingerprinting capacity is in 0(1/ k^), but they 
also provide secure strategies for both players of the game. 
Along with the numerical saddle-point solutions for small k, 
we study the asymptotic behavior of the game for large k. 

The outline of the paper is as follows: In Section [III 
we formally define fingerprinting capacity and review the 
capacity formula derived in [9]. The derivation of the single 
fingerprinting capacity game is shown in Section Hill and 
Section HVl is devoted to the binary alphabet case. 

II. Problem Statement 

A. Notation 

We use capital letters to represent random variables, and 
lowercase letters to their realizations. Boldfaces denote vec- 
tors, and calligraphic letters denote sets. For example, X e X" 
denotes a random vector {Xi, . . . , Xn), with each Xi taking 
values in X. The probability distribution of X is denoted by 
px- The entropy of a random variable X is denoted by H{X). 
The mutual information of X and Y, with joint pmf p is 
denoted by /p(X;y) = H{X)-H(X\Y). We also denote the 



binary entropy function by h2{p) = —plogp— (1 — p) log(l — 
p) and /i2(p) = {h2ipi), ■ ■ ■ ■.h2{pn)y- The KL divergence 
between two Bernoulli random variables with expectations p 
and q is denoted by d2{p\\q) ^ plog ^ + (I — p) log j-:^- log 
denotes base 2 logarithm and In denotes natural logarithm. 
Mathematical expectation is denoted by the symbol E. The 
shorthands f ^ g and f ^ g denote asymptotic relations 
limfc_»oo ^ = 1 and liminffc^oo > 1 respectively. 

B. Overview 

Let Q = {0, 1, . . . , (7 — 1} denote a size-q fingerprint alpha- 
bet, and A4 = {1, . . . , to} denote the set of user indices. The 
fingerprint encoder assigns each user a length-rt fingerprint, 
using an encoding function 



fn-Mx Wn 



(1) 



where the secret key Wn G Wn is a random variable whose 
realization is known to the encoder and the decoder, but 
unknown to the pirates. 

A coalition K, is any size-fc subset of M, and X^: = 
{Xi, . . . ,Xfc} are the fingerprints available to the coalition. 
The collusion channel produces the forgery Y £ Q" according 
to distribution Py|Xk- The marking assumption states that if 
for some j G {1, . . . , n}, xij — ■ ■ ■ = Xkj, then j/j — xi_j. 

Not knowing the actual collusion channel Py|Xk;' '^he single- 
output decoder 

gn : Q" xWn^M (2) 

accuses exactly one user based on the forgery Y and the 
secret key Wn- The encoding and decoding functions /„ and 
gn are deterministic, but a fingerprinting code is a random 
variable {Fn,Gn) whose distribution is characterized by that 
of Wn- Under fingerprinting code {Fn,Gn), the worst-case 
error probability is defined as 

P;(F„, G„, k) = max max Pr (G„(Y, Wn) ^ IC) , (3) 

|K;|<fc 

where the second maximization is over all Pyixk satisfying 
the marking assumption. 

C. Fingerprinting Capacity 

We now define fingerprinting capacity and review the ca- 
pacity formula [9] under the marking assumption. Capacity is 
achieved using a random coding scheme. 

Definition 2.1: A rate R is achievable for the g-ary alphabet 
and size-fc coalitions if there exists a sequence of fingerprinting 
codes (F„,G„) for to = [2"^] users such that 



lim F;(F„,G„,fc) = 0. 



(4) 



Definition 2.2: Fingerprinting capacity Ck,q is the supre- 
mum of all achievable rates for the g-ary alphabet and size-fc 
coalitions. 



Now for a random variable W defined over an alphabet 
yV = {l,2,...,^}, we define the embedding class 



^XkW = \pXk.w{xk,w) ^ Pw{w)'Wpx\w{Xr\w) 



4=1 



the collusion class 



PYlx^ivlxK.) = 1 if 2/ = xi = • • • = Xk}, 



(5) 



(6) 



where tt : /C ^ /C is a permutation of the coaUtion /C, and the 
function 



G' -i 



max 



mm 



IiX^;Y\W). (7) 



Theorem 2.3: [9, Theorem 3.4] The fingerprinting capacity 
Ck,q for the g-ary alphabet and size-fc coalitions is 



Ck^q = lim Ck^q- 



(8) 



Fingerprinting capacity is the limit value of a sequence of 
maxmin games. For any fixed I, G[ ^ is the maxmin value 
of a two-person zero-sum game with the content distributor 
as the maximizer and the coalition as the minimizer. In the 
achievability proof, is a time-sharing random variable. As 
I increases, it gives the content distributor more flexibility in 
choosing the codes. Hence the sequence G[ ^, 1 < ^ < oo, is 
nondecreasing and admits a finite limit. 

However, it is not an easy task to evaluate G[ ^ as well 
as the capacity-achieving probability distributions, even for 
small values of L The reason is that a saddle-point solution is 
generally not guaranteed. For the binary alphabet (q — 2) and 
Z = 1, we can derive that 



1 



2-(fc-i) 



which is not achieved by a saddle-point solution when fc > 2. 
Also, this is very loose lower bound for G^ 2 comparing to 
the 8(fc~^) bound we will show in Sec. IIV-CI 

III. The Two-person Zero-sum Game of 
Fingerprinting Capacity 

To establish the desired saddle-point property, we first 
reformulate the fingerprinting capacity as the value of a single 
maxmin game. Consider an auxiliary random vector W drawn 
from the g-dimensional probability simplex 

r 9-1 1 



^ <^ w e M« : 2^ = 1 and < < 1, x e Q 

I x=0 



(9) 



and the class of joint distributions 



^XkW = {pxK;w(a;/c,w) =Pw(w)]Jj3jf|w(a;j|w), 

where px|w(a:^|w) =Wx,xe Q}. (10) 
Then we can express Ck,q as in the following theorem. 



Theorem 3.1: 



IV. Capacity for The Binary Alphabet 



(^k,q — Y max min 



liX^lYlW). (11) 



Proof: Note that the class ^XicW is compact and 
the payoff function is bounded, hence the maximizer exists. 
Denote the right-hand side of (fTTT l by g. We can show that 
C*!- q > Ck,q and ^ < Ck.q respectively. For lack of space 
we skip the complete proof but give only the outline. For any 
finite I, let 

Px^wixK,w) = Pw{w)Y[pxlwix^\w) & ^x^W (12) 

and Py^x ^ ^Y\Xic the probability distributions that 
achieve d^. Let 



Pw(w) = Pwiw) 



(13) 



wes^ 



where 



(14) 

then we can verify that the resulting px^w satisfies 

(T5[ shows that for any Px^iv defined in (fT2] l. we can find 
a probability distribution in ■f^'x^w that achieves C[. ^. Thus 

The proof of ^ < Ck,q utilizes the continuity property of 
mutual information, by which we can show that the sequence 
(C[. g)fZi is lower bounded by a sequence converging to C'f. 
Hence C'k g = Ck,q. '■ 

Theorem 13.11 states the fingerprinting capacity as the 
maxmin value of a two-person zero-sum game. Note that 
since px|w is actually fixed in the class of joint distributions 
defined in ( fTOl i, the maximizer only has control over pw, 
which lies within the class of probability distributions over 
W, denoted by Also, the payoff function /(X^;; Y\W) 
is a linear function of pw for fixed Py\Xic ^^'^ ^ convex 
function of PY\Xfc fo'" fixed pw- By the minimax theorem 
[12], the game admits a saddle-point solution. In the game- 
theoretic point of view, this is a so-called convex game [13, 
§2.5]. The maximizer has an optimal mixed-strategy with a 
finite support and the minimizer has an optimal unique pure- 
strategy. Furthermore, the maxmin value equals the minmax 
value of the same game restricting both players with pure 
strategies. The following theorem states these properties. 

Theorem 3.2: 



Ck,q = 7 min max I{Xk:;Y\W ^ v^) 

k Py\x^(^-^y\Xk. w6^? 

= y max min I{X,c\Y\W). (16) 

k pwe^w py\x^<^-^y\x^ 



We have established the existence of a saddle-point solution 
for the capacity game. For the rest of the paper, we focus on 
the binary alphabet case and see how the game can be solved. 

A. Game Definition 

We can simplify the game as follows: 

1) Fingerprinting Code. Q = {0, 1}. The auxiliary random 
vector W now has only one degree of freedom, and we 
redefine it as ly e [0, !]• Pw denotes its distribution, and 
Ws the support of pw- Px\w ^ Bernoulli(M^) is fixed. 

2) Collusion Channel. Since Py\Xk: ^ '^y\Xk: defined 
in (|6]l is invariant to permutations of /C, it takes the 
form Py\z^ where Z = ^ {0,1,...,A;} is 
the number of I's in X/^. Let p = {pq, . . . ,Pk)' , where 
Pz = PF|z(lk)i z = 0, . . . , /c. The marking assumption 
enforces that po = and pk = I, and the collusion 
channel is then completely characterized by p. 

3) Capacity. If we let a{w) = (q!o(w), ■ . . , afe(w))', where 



az{w) = Pz\w{z\w) 



(17) 



is the binomial distribution with parameter w G [0, 1], 
then we have 

C{w,p) ^ I{X,c;Y\W ^w) 

= H{Y\W ^w) ^ H{Y\Xk:,W ^w) 



= ^2 y^p^Qz(w) ~y^^h2{pz)az{w) 

= h2{a'p)-a'h2{p). (18) 
Another representation of C{w,p) is 

C{w,p) = D{pyz\w\\py\wPz\w\W ^w) 

k 

= Y.a,{w) d2{pz\Wp) (19) 

The fingerprinting capacity game for the binary alphabet 
under the marking assumption can then be written as 



Ck,2 = 7" max min 

fc Pw P 

1 



CiW,p) 



= —min max C(w,p). 
k p w 



(20) 
(21) 



B. Analysis of the Convex Game 

Lemma 4.1: If p* is the minimizer in ( |20] | and ( |2TI ). then 



P*z = l-Pfc-z>2 = 0:---;fc- 

Also, if p^ is the maximizer of ( |20] |. then 

P*w{w) = p*w{l - w),yw e [0, 1]. 



(22) 



(23) 



We skip the complete proof of Lemma 14.11 here but only 
explain its idea. Note that p* represents the probability of 
assigning F as 1 when Xjc has 2; I's and (fc — z) O's. By 
symmetry we should expect in colluders' capacity-achieving 



k,2 



Strategy, the probability of assigning F as when Xjc has then we have 
{k — z) I's and z O's to also be p*, i.e., pl_^ — 1 — pi, z = 
0, . . . ,k. Similarly, the capacity-achieving fingerprinting codes 
should have the same distribution for and 1 , hence should 
be symmetric as stated. 

Owing to the existence of the saddle-point solution, p* and 
pi^ must satisfy the following: 

1) When p = p* is fixed, C{w,p*) is a differentiable 
function over the unit interval. The support of p^, Wg, 
can only take values at the maximizers of C{w,p*). 
Hence we have 



> 



(a) 
> 



— max min Ep„, 
k pw p 

— min E. 
k p 



C{W,p) 



1 fc 



^ayXw)d2{pz\\oLp)Pwiw)dw 



2 = 



fcln2 



/ a^(w)(pz - OLpfp'^(w)dw 



kQ 



k,2 



s ■ 



(24) 



2) When pw 
satisfies 



C{w,p*) 

aw 

p'^ is fixed, and if we only consider p that 
, then we have 



9P; 



-C{W,p* 



0, 



1, 



k-l 



(25) 



By the convexity in p of the payoff function, we know that 
l^s I ^ L^J (^^^ [13, §2.5]). With a fixed support cardinal- 
ity, we can obtain candidate capacity-achieving distributions 
p* and p^r by solving (|24] | and dZSl l. and then verify those 
candidate distributions are optimal by examining the second 
partial derivatives. Once p* and p^ are found, we can get 
Ck,2 by substituting them into (|20] |. 

C. Bounds on Capacity 

For general k, the following two theorems gives us Cfe 2 = 

e(i/fc2). 

Theorem 4.2: 

1 1.443... 



fe,2 



< 



A:2 1n2 fc^ ' 

Proof: 

Consider the so-called "interleaving attack" p'^ 



(26) 



defined by 



then we have 

Cfc,2 — 
< 



— min max C{w,p) 
k p w 

imax C{w,p°°) 
k w 



< 



— max 

k w 

1 

fc2 ln2' 



2 = 



(27) 



where the last inequality results from [10, Theorem 4.3]. 
Theorem 4.3: 

2 0.292... 



a 



k.2 



> 



fc27r2ln2 fc2 • 

Proof: Consider the continuous distribution 
1 



PwH 



(28) 



(29) 



> 



(J 
id) 



/o^E2=o/l(2'H 



p^{w)dw 



fcln2 
2 



where 
and 



fc27r2 In 2' 
fi{z,w) = az{w){pz - Q.'p){z - kw) 

f2{z,w) = az{w){z - kwY. 



(a) follows from Pinsker's inequality [14, Lemma 11.6.1]. (b) 
follows from the Cauchy-Schwarz inequality. The numerator 
of (c) follows from 

k k 

= ^az{w){z - kw)pz 



2=0 



2=0 



-a'pE[Z ~ kw\W 



w\ 



=0 

= w(l - U')(— )'p, 
while the denominator follows from 

k 

^/2(z,w) =E[{Z ~ kwf\W = w] =kw{l-w). 

2=0 

Finally, (d) follows from the marking assumption: a'(G)p = 
and a'(l)p = 1. ■ 

D. Asymptotic Behavior for Large Coalition 

We solve the capacity games for small k's using (l24l) and 
dZSl l in Sec. IIV-BI Fig. [T] shows the capacity along with the 
upper and lower bounds. Amiri and Tardos [6] stated without 
proof that Ck,2 ^ (fc^21n2)^^. Our numerical results suggest 
that this bound is tight and that the convergence is fairly quick. 

Evaluating the convex game of ( l20b or (I2TI 1 for large k 
is still a difficult task. However, Theorem 14.21 and 14.31 shed 
lights on the asymptotic behavior of the game. If a less 
powerful coalition simply chooses the interleaving attack as 
their strategy (a.k.a. "uniform channel" in [10] and "blind 
colluders" in [5]), Theorem 14.21 shows that the gain in rate 
is no more than a factor of two. In fact, one can show that 
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Fig. 1. Capacity Cfc,2 ^nd upper and lower bounds 
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Fig. 2. Difference p* — for fe = 5, 10, and 37 



C{w,-p'^) - (fc21n2)-i for all w £ (0,1) (based on results 
from [15, §1.6]). Fig.|2]shows the difference between p* and 
p°° for different values of k. This suggests that the interleaving 
attack is asymptotically optimal. This also answers Furon 
et fl/.'s question in [5]: the fingerprinting code can only be 
slightly shorter even against a naive coalition who performs 
solely the interleaving attack. 

An even bigger issue for the content distributor is that 
the computation of the optimal is infeasible for large 
k. Luckily, Theorem 14.31 resolves this predicament. By using 
Pw °f (l29] l, the loss in rate is only by a factor of about 
2.5. Fig. [3] suggests, surprisingly, that converges to 
in distribution. The same distribution was used in Tardos' 
fingerprinting code in [3], which uses a simple decoder and is 
designed to be independent of the collusion channel [5]. This 
unifies the asymptotic distribution of for the simple and 
joint decoders (see [9]: is asymptotically optimal. 

We conclude with the following conjecture: 

Conjecture 4.4: When fc ^ oo, we have 



and 



Cfc,2 ~ (fc221n2)- 



Vw ~^ Pw distribution. 



(30) 



(31) 



(32) 




Fig. 3. Cumulative distiibution function of and for A; = 5, 10, and 
37 
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